Breadcrumbs

Grant Conversation List Access to Evaluator in Keycloak

Grant Conversation List Access to the Evaluator Role in Keycloak

By default, an Evaluator can only open the Reviews List screen in Unified Admin. This guide shows how to give Evaluators access to the Conversation List by adding the evaluator role to the Conversation List authorization policy in Keycloak.

This is a standalone configuration guide. It does not change the default Quality Management IAM setup. Follow it only when Evaluators must also use Conversation List.

Prerequisites

  • You have Keycloak admin access.

  • The Quality Management authorization configuration is already imported on the cim client. See IAM Configuration For QM.

  • The user already has the evaluator realm role. If the user does not have this role yet, assign it first from Users → Role Mapping.

What this changes

Keycloak Authorization Services use this hierarchy:

  • Resource and scope: quality-management with scope conversation-list-manage.

  • Permission: links that resource/scope to one or more policies (for example, conversation-list - quality-management - conversation-list-manage - permission).

  • Policy: defines which roles are allowed (for example, quality-manager). This guide adds evaluator to that policy.

After you finish, users with the evaluator role can open Conversation List in Unified Admin.

Step 1: Access Keycloak

  1. Open the Keycloak Administration Console in your browser: https://<FQDN>/auth.

  2. Click Administration Console.

  3. Log in with an admin account. The default username and password are admin / admin unless your environment uses different credentials.

image-20260820-070232.png


Step 2: Select the correct realm

Keycloak opens the Master realm by default. Conversation List policies live in the tenant realm.

  1. Click the realm dropdown in the top-left corner.

  2. Select the tenant realm. In most Expertflow deployments this is Expertflow.

Step 3: Open the cim client

  1. In the left sidebar, click Clients.

  2. From the client list, click cim.

image-20260820-065527.png


Step 4: Add the evaluator role to the Conversation List policy

  1. Stay on the cim client and open Authorization → Policies.

  2. Open policy named conversation-list - quality-management - conversation-list-manage - policy.

    image-20260820-070740.png

  3. Click Add roles.

  4. Select the evaluator realm role.

  5. Confirm Logic is set to Positive.

  6. Click Assign.

  7. Click Save.

image-20260820-070720.png


Step 5: Verify access

  1. Log out of Unified Admin if you are already signed in as that evaluator.

  2. Log in with the evaluator user.

  3. Confirm Conversation List is visible under Quality Management.

  4. Open Conversation List and confirm the page loads.

If Conversation List still does not appear, the user may need to sign out and sign in again so Keycloak issues a new token with the updated permissions.

Troubleshooting

  • Evaluator still cannot see Conversation List: Confirm the user has the evaluator realm role, then sign out and sign in again.

  • Wrong realm: Confirm you are in the Expertflow/tenant realm, not Master.